Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Dragon_Eater, with "lots of experience setting up PCs and a passable knowledge of Linux but severely lacking in the server/client department,"
writes with a situation that probably faces a lot of parents:
I want to set up three kids, 12, 14, and 15, with newer computers so they will stop fighting for time on the one ten-year-old Dell they share now. I can get the individual computers and a server put together without any problems, but the computer-handicapped single parent needs to be able to do the following via an simple application/web page: View client computer status, On/off, sleeping etc.; Deny Internet access, not LAN, just the web; Schedule time usage of computer, ex. 7 am to 10 pm on school nights etc.; Force log-out and/or shutdown of clients, for grounding purposes; and Apply some kind of firewall filter for blocking undesired web content. And as the administrator for this network I would like the following options: Remote virus scanning of client machines, or scheduled task; Some kind of hardware monitor, high temp / fan speed low etc.; and Email alerts for various log files / alarms.
Given the lists above I am thinking about a Linux-based router/server machine and running Windows on the clients for game compatibility. I also know that a server and network boot client is possible but not sure where to start on that one."

Not really... Basic Desktop support, and a more sophisticated gateway. Something like m0n0wall http://m0n0.ch/wall/ [m0n0.ch] has very good access control with a voucher system, you user based control built in. It also has a very good traffic shaper so one kid downloading won't cause a fight with the other kid gaming. However, no web filtering.

Untangle http://www.untangle.com/ [untangle.com] has some very good filtering on content and viruses, as well as some ads. The captive portal is not as strong, but getting there. No real traffic shaping last time I checked.

Both are open source projects. Monowall will run on any old P3 with 128 meg of ram. Untangle will need a bit more power behind it.

Not really... Basic Desktop support, and a more sophisticated gateway. Something like m0n0wall http://m0n0.ch/wall/ [m0n0.ch] has very good access control with a voucher system, you user based control built in. It also has a very good traffic shaper so one kid downloading won't cause a fight with the other kid gaming. However, no web filtering.

Untangle http://www.untangle.com/ [untangle.com] has some very good filtering on content and viruses, as well as some ads. The captive portal is not as strong, but getting there. No real traffic shaping last time I checked.

Both are open source projects. Monowall will run on any old P3 with 128 meg of ram. Untangle will need a bit more power behind it.

Good options. He could also try ClearOS [clearfoundation.com]. After it is set up it should be rather low maintenance. The download link is on the page. I have one at home and it is a win.

AND, to continue singing the praises of ClearOS as the perfect solution to the server/gateway side of OP's requirement, it includes among other thigs:

- an email gateway/server- proxy server with content filtering- protocol filtering (mommy/daddy can limit those pesky torrents or set up time based filters to gaming servers) He could even give some protocols bandwidth priority at certain times of day - more gaming over weekends, more http at other times.- shared folders for users

Heck there are tons of features, some not really needed but others perfect.

and lots more. ClearOS would be the best to use, also there is an active forum where OP can ask for assistance, and $singleparent can sign on for help.

Heck OP can log into the server remotely and assist with any issues requests that might show up.

This is all awesome stuff, but really when confronted with all of this I would just go next door or go to the library to look up what I wanted on the net and email whoever I pleased (facebook etc..) and so will these kids.

limiting Kids is not going to teach them anything you have to educate to do the right thing.

It is more like; take a active interest in your kids lives, talk to them even about the hard subjects. Let them learn from your experiences and mistakes. Don't rely on technology, other people and laws to do your job for you.

I like to follow the KISS principle (keep it simple), because I don't like major projects or headaches. The MAIN issue here is that you've got 3 kids and 1 computer, so my solution would be to get 1 computer per kid. Ebay sells used XP laptops for about $100 plus shipping. Buy 3.

I'd put all 3 computers in a "computer room" that opens at 6am and closes at 10pm, plus allows me to monitor what my kids are doing. Not that I mind them looking at nudie pics or whatever, but I'd still want to be AWAR

I bought one of those (Compaq n400c). First it was the trackpad, then the keyboard lost some keys, then the HD started failing. In less than 6 months it was useless as a PC. I still use it as a server, though (doesn't need the trackpad or the keyboard, and I use a flash drive for the OS/software and an external drive for storage).

He didn't say a locked room, just a common area designated as a "computer room". Putting the computers in a common area (be it a locked computer room or the corner of a living room) so you can keep a general eye on what they're doing, and you solve all of the content issues.

Tell your children that they can use the computer from 6am to 10pm. You don't need to lock them away in a room - if they obey, that's their sleep cycles protected. Punish the

I totally understand where you are coming from, but I think restriction might be the better option. Logs will allow you to see if your child is visiting sites you do not approve of, but it won't make the 12 year old unsee that video of "Hot Asian slut taking it in all three holes at once". (I'd assume this is one of the things that he is trying to filter out). Also, it may not be the child's intent to go look at said video. It might be a bait and switch link that takes them there, some malware infestation, the 15 year old jumping on the 12 year old's machine to do his porn surfing, or some other scenario where it really isn't the 12 year old's fault.

Plus, depending on how much surfing the kids are doing, there could be a pretty big list of logs to go through every day.

And of course the biggest issue.....do you think the parent has the time for the hours of talk/psychological help that would be required if one of the kids ran into goatse.cx? One bad click and the kid would be damaged for life. The parent could only hold the child as they rocked back and forth trying to sleep but unable to remove the image that has burned itself into the retinas.

Ask the two oldest kids for technical support? You can put up any barrier you want but they will find a way around it.

Seriously: At that age you can guide them but you can't control them. Keep the machine(s) in a public area of the house. Observe what they are doing. Talk to them. The most important thing is to be honest with them. At that point in life you are preparing them to leave the nest. In 3 or 4 years they will ready to leave and face a world without parental controls or filters. Prepare them the best you can and have some confidence in them. Letting go is very difficult.

Heh, I had a computer in my room with internet when I was 14... As did my two younger brothers at a similar age.

Luckily my parents are fairly open about anything would not block me from accessing anything. I knew that if there was anything I was curious about I could look it up.. If I did not understand it I would just ask either my mom or dad depending on what the subject was.

Being a 14 year old boy of course I started collecting various pieces of 'art' and had an extensive collection by the time I was 16:-pNow.... Did this damage me or turn me into a serial killer or rapist? Nope. Neither of my brothers are nutters either *chuckles*

Having two teachers as parents can be quite nice. Of course it did mean that logic was king. If I could reasonably argue why I should be allowed to do something I was allowed to do something. Whining did not work -at all-. Presenting a reasonable set of arguments for my position always did (asssuming they agreed, which they usually did).

Learning these things is essential to any kid/youth. I personally think many of the problems in the world now are based on people not learning basic skills regarding how to communicate.. Especially regarding disagreements.

Why do I suspect you are much closer to being a kid than to having one?

Restrictions can tell a kid "I give a fuck about you," not just "I don't trust you." A lack of restrictions can mean "I either don't give a shit about you or have given up." If a kid already has a dogged determination to see porn and shock sites, then yes, it's probably shutting the barn doors after the cows have gotten out. But that's seldom the issue.

Why do I suspect you are much closer to being a kid than to having one?

Because it's when you get one when you start rationalizing irrational behaviour regarding them?

Restrictions can tell a kid "I give a fuck about you," not just "I don't trust you."

If you suspect that he's a kid since he says it's the second message he got, implying that that's what a kid would get, why do you then turn around and assert that a kid will actually get the first one?

Most of what you described can be done with a decent modern router. The hardware monitoring is a bit overboard, logs will tell you what you need to know in the event of a disaster. The force log out could be done via router too, just deny internet. Alot of this can be done with very little technical effort and more parenting skill. Most of this is going to take a dedicated person to monitor it over the course of the installation.

We use this approach in our house with teens using a Linksys router. I set up access permissions by MAC address for the kids computers. Our other computers use for work and my wife are all password protected. I disallow internet access between 11 pm and 6 am generally, and occasionally block some sites if they prove to be problematic.
The computers run Vista and we use the basic internet filter provided to restrict content to porn sites (though this is inadequate). Parents have the right to inspect the co

The motto here is Trust but Monitor. Trust in that there there is some, but not much software that blocks prohibited sites so we need to trust the kids to make good choices. We've been doing this since they were about 4 or 5 - this doesn't happen over night. They're not likely at this point to bypass the security I've set up, but I'll leave that open to the possibility in the future.

You say this as if it were a bad thing. Both those topics are +10 interesting to kids and the skills they learn certainly come in handy later. I fear the newer generations lack that sort of interest and, coupled with the increased complexity of modern systems, could be responsible for a shortage of talent. Already too much of what I see is old stuff tweaked a little.

It strikes me that making a child work to learn what they need to know in order to get what they want could be used for a variety of educational purposes. Want Facebook? Learn to hack the router. Want the car for the weekend? Learn to break the encryption on this cypher-locked safe. Want to avoid a grounding? Learn to blame it convincingly on your sister. Want to eat tonight? Learn to pick the lock on the refridgerator.

Sure, they may not pass standardised tests requiring them to know the average rainfall of the amazon rainforest (what a useless fact!) but it does give them valuable real-world skills.

It's amazing what kids can do with computers, period. I think it's safe to say that these kids will soon be way more computer-savvy than their mom, if they aren't already. No reflection on her intelligence, kids just learn this stuff fast.

If I were her, I'd forget about software barriers to their computer (mis)use and just make sure I knew what they're doing.

Agreed. Once upon a time, my father forbid me to use our 486SX. At that time, it was common for computers to have a key switch (like this [made-in-china.com]), which would prevent booting when locked. I got so pissed off I made a key out of the cap of a bic pen:-).

And what happens when they clone the MAC address of an unblocked computer (such as the parent's computer)? Bypassing filters that only block some machines on a network doesn't exactly require a genius.

Create 2 networks - one that doesn't extend outside of a locked rack, and one that goes around the house... The former is the only one with direct internet access and accessing it from the latter requires using a vpn client...

this is really easily done! 1) talk to your kids, be a real parent!!! i don't think you'll ever have a case where little billy gets in trouble at 1pm and you need to disconnect his computer rights from work. 2) if they need to be punished unplug the computer and take it away. 3) have admin rights to their computers so you can keep tabs on what they're doing and can't hide anything from you.

Where to start: Scrap all your ideas and start over.Yes, everything you asked for can be done. The reality is though is that, with the amount of complexity you are asking for, you will be a full time sysadmin for them - you might as well quit your day job now.

Your setup is simply too complex for a non-techie (and to be honest, as a techie, I don't want to have to admin something that complex at home). You need to stop asking "can I" and ask "should I?"

Windows PCs joined to active directory can let you manage them, set logon hours, etc.

Why do you care to know if the PCs are sleeping/on/off/whatever?

A router running DD-WRT will let you deny internet access based on hours and/or PCs in a simple manner. To be perfectly honest, I hate the concept of internet filtering (by parents or otherwise) as I believe it is another step toward turning people into drones, rather than teaching them to think for themselves, so I'm not even going to offer any suggestions on that subject.

I agree with the other posters, the system you have suggested will end as follows:1. The kids will learn how to hack around it. This can be a good thing or bad thing, depending on your point of view2. The system is so complex it will never work and the parent will never use it as they have no clue3. You will grow to hate it as it will take too much of your time.

We use a program called SynchronEyes which does most of these things, allows you to see essentially thumbnails of what each machine is doing, see its status remote on/off etc. It's Windows only. I see they've changed their product. It's called SMART Sync now. I don't see pricing which is probably not good. Here's a link [smarttech.com]It's a pretty front end for VNC like functionality which would be free/oss but nowhere near as easily set up (but I'd wager largely what people will say since you specifically mention Linux and Windows and it works on both). I'm not really an expert on this part, but SychronEyes has worked well, after I added it to a custom Ghost image for that lab and set the clients to use hostnames instead of usernames for identification. It might be overkill for what you need though.

1. You either come up with a "normal" computer usage policy, you know, talking to your kids about stuff like porn, sex, appropriate computer policy in your house (better not be too strict on this one:P), purpose of getting them the computers, internet privacy, etc, or,

2. don't and the kids will get to all the "inappropriate" places anyway and may get you into more trouble than you ever imagined.

Frankly, you can't "filter" porn. If someone wants to get it, they will. Maybe this is one of the good sides of internet porn - parents forced to deal with sex-ed of their kids. Although most go the "easy way" and pretend it doesn't exist - "but I installed a filter!!"

Second, I would be much more nervous about insisting that your kids DO NOT use any of the file sharing software without prior permission, on case-by-case basis. Explain about the MAFIA, I mean, MPAA and the like on their lawsuit campaigns.

I'm doing something similar but in our family, we've got a 7 and an 8 year old and a 3 year old, so it's a different "ball game".

In our situation, I don't bother trying to put Linux on any of their machines. I've found that for the younger kids, the vast majority of their time spent playing anything Internet/web-based involves Shockwave Flash based sites (or sites using other proprietary 3D player plug-ins). Unfortunately, nothing runs this stuff quite as well as either a Windows XP (or later) OS, or a newer Mac running a recent version of OS X.

I found a free add-on for Firefox called Kidzui that was pretty nice. It basically turns the browser into a "kids' browser" that has a "home page" with good suggested sites for them to visit, and lets them click and explore around in a big collection of known "kid safe" web sites. Basically, it doesn't allow going anyplace except sites they pre-approved, but they make the whole experience feel like the kid is just getting around the net without restrictions. Additionally, it can email the parent weekly stats on the sites they spent the most time using, etc.

If you're using a Mac, OS X has pretty nice parental controls built into the OS for things like not allowing use of the machine after certain hours. I didn't find Windows had nearly as nice of capabilities for that, out of the box (though Windows 7 was closer than any previous version of Windows to offering it).

Honestly, I'm not that "sold" on putting forth the effort of setting up a lot of centralized administration and maintenance for the machines on a small home network (like for 3 kids). You may as well put free anti-virus/spyware software on each computer and let them auto update themselves independently. The products that support centralized management of the AV software tend to be expensive and/or buggy. (You get weirdness like one box that gets out of sync with the server console, so you have to mess with things to get them to both be on the "same page" about the workstation's status again.)

If anything, I think it'd be worthwhile to image the drives of all the machines, once they're freshly set up with the OS and applications and configuration defaults you like. Then, if one gets screwed up, you can just wipe its drive and re-image at will from your network server. Typically, on a kids' PC, they don't have that much important data to worry about losing anyway. If they're doing most things on the net, the sites they use are saving their high scores, user profiles, and such.

So you are ok with your kids being on AIM all day looking for older guys who make them feel special? Or surfing porn all day? Or, even doing what you want and accidentally running across goatse guy? He's not looking to be the gestapo. He's looking to have some basic protections in place to protect his children from the unsavory parts of the Internet, and to make sure that they don't abuse the priviledge of having a computer in their rooms.

Sure, he could fix this by doing what he does now, having one computer for all three in a public place. But he's trying to improve their access, not limit it. And he just wants to make sure that improvement isn't abused.

So you are ok with your kids being on AIM all day looking for older guys who make them feel special?

If a teen is looking for older guys to make them feel special, she is already emotionally vulnerable and needs some help. Cutting off the computer/internet without providing some support will just make her look for someone in real life.

Or surfing porn all day?

Pretty much the same deal. Your job as a parent is not to pretend that porn does not exist, but to explain that the behaviors depicted in it are unrealistic and often unhealthy.

Or, even doing what you want and accidentally running across goatse guy?

Look, sooner or later your precious little angel will see that pic. He or she will also see many other disgusting things, both in real life, on television, and on the web. You can't prevent that, but hopefully you can give enough context to allow little Junior or Princess to assimilate it and get on with his or her life.

He's not looking to be the gestapo. He's looking to have some basic protections in place to protect his children from the unsavory parts of the Internet, and to make sure that they don't abuse the priviledge of having a computer in their rooms.

Look at the age ranges again. They're not going to accept those kinds of top-down restrictions blindly. They'll get that you don't trust them, aren't telling them what they can't see, and become naturally curious about it. And since you've given them no background or explanation at all, they'll have no frame of reference for assimilating it in a healthy way.

Nice quip, but completely wrong. You just made the argument that you should never put a lock on the cabinet under the sink with all the nasty chemicals because if you use a lock, then you are having that lock be the parent and that lock is a lousy parent. You don't abandon locks on dangerous chemicals because using a lock means you are a bad parent. I've taught my kids to not go under the sink. And they don't. And there's a lock on it anyway. I guess by your reasoning I'm a bad parent using a lock for a parent, but I'd rather have the lock than to find my 3 year old drank drain-o.

It's possible to use technology (like a lock on a cabinet) to assist you in being a parent.

And don't put the PC in their room. Putting the PCs in the family room is not limiting access. Putting down firewalls and time limits is limiting.

Great, so you are telling the person asking the question that they are doing wrong. "How do I fix my Toyota?" and your answer is "Screw Toyota, get a bicycle." It might be the better solution, but isn't an answer to the question asked. They want to get the PC out of the shared space. They want to get it in the rooms. So how do they do that best? Your answer? "Don't do it." I understand your answer, but it isn't an answer to the question asked, and I've been confining my comments to the question asked. If you have fundamental issues with the question itself, then everything you say is off topic.

Where N is the number of computer users and you want them in a shared space, not in each child's room. Providing each child a personal computer, especially in his room, is a guarantee that any kind of interaction between you and your kids and between themselves will end. Ensuring computer "scarcity" will force you and, more importantly, your kids to interact with each other. It may even force you and your kids, gasp, to share a computer.This also has a couple side benefits:1. There are no "secrets" on the computers so you have no need for the tight monitoring and/or policing you seem to think you want.2. Virus infections become a shared painful experience with obvious lessons being learned on how to avoid it the next time.

HW monitoring is kind of pointless as it won't tell you anything.

This only leaves you with a couple problems to deal with:1. backup - there are plenty of backup solutions out there. Generally, you'll want some kind of external drive setup with automated user data backups.2. virus recovery - If you like anti-virus software, use it. However, you should probably also keep a fresh install method handy so you can simply re-install without having to deal with the mess (this is where a good backup becomes very important). Taken a step further and to save lots of time you could have all your machines running VM hosted Windows images. Then when one of the images gets infected or otherwise "goes bad" you simply revert to the latest and greatest clean VM image (user data backup is still very important).

Both Windows 7 and OSX have parental controls that enforce usage times in a per-account basis, which apps can be run from these accounts, which sites can be accessed, etc. I have been using these with OSX (a good write up at http://theappleblog.com/2009/01/13/kid-proofing-a-mac-with-parental-controls/ [theappleblog.com]) with my 11-year old autistic boy and they couldn't be any simpler. He can only log into the machine at certain times, and I have the option to set a maximum session time per day. He can only run apps that I approve, and can go to sites only if I explicitly allow them. The bad news is that, at least in OSX, Firefox doesn't respect the parental control settings (Safari does it fine).

My only real annoyance is that Youtube doesn't have real content rating, which makes it a pain to filter properly. My son loves to make balloon sculptures and is always checking for new video tutorials, the problems is that while looking for these, he runs into the videos of the balloon popping fetishists. One second I am hearing a video explaining how to twist balloons into a roadrunner, next I hear a 300-pound woman in a bathing suit giggling and sitting on balloons to pop them. Gross.

There are products you can buy that are normally used in businesses, that allow you to do key stroke logging, remote snooping the screen, etc. If you're as paranoid as the business that use these tactics on their workers then I'm you can find them with the Google. I don't expect they will be cheap, and they will require a lot of setup, you'd also have to do this away from home for obvious reasons. But if you mistrust your kids that much already I'm sure you're prepared for that.

Buying a Mac is going to be way cheaper than dealing with viruses on Windows or trying to learn being a Sysadmin on Linux. Buy Mac Minis and cheap monitors/keyboards/mice or pick up a used MacBook or iMac. Look for something that has the extended warranty - hardware failures will be repaired for free. You could even consider getting them an iPad with a keyboard, and only installing the applications you want them to use.

packet filter allows rules to control local NAT and redirection of connections to/from external addresses. But this does not control clients for all of the other functions you are asking, that probably can be done with PCAnywhere or some other VNC.

However it is not a simple task, from 0 to everything works it may take many many days if you have never done it before.

What they NEED to do is supervise what their kids are doing - not leave it up to the server - the kids will get around that SO quick.

All you're doing is giving a false sense of security.

Put the computers where the single parent can SEE the kids using them. And they can see each other. If you start hearing lots of giggling, check to see if they're looking at porn. Also, the kids will snitch on each other if they can see what they're doing.

I'm losing some mod points by posting this, but I didn't notice the ages here -- 12, 14, and 15? Let them have some old/spare computers if they want. Show them where to download a virus scanner and tell them that if they break anything, they have to fix it. I don't see what the issue is here. They are going to have homework the requires the Internet anyway, so shutting down access after 10pm and in the early morning is just going to hurt them.
By the way, my middle and high schools implemented strict filtering schemes on their networks. We had to put a fair amount of effort into getting around them *not* because we wanted to browse facebook/myspace/b/ at school, but because we often did research for our essays on school computers, and we wanted actual, balanced evidence, rather than the limited and biased crap that the filters let through.

This is one area where Linux amazingly has been lacking. Home Domain Controllers. You can create a home domain controller with features Windows has never dreamed. Its just really really, really too hard. There needs to be a Home Domain controller Application added to most Linux Distributions.

Mandriva comes close to this with the ability to setup fully functional Samba Domains stand-alone only. But if you try and configure OpenLDAP, Kerberos, Squid, FreeRadius or anything else, it becomes a time vampire to get it all working right. And its not that the software is buggy. Its that often, the software is configured badly, and not at all.

In "about three years" by yer own figures, the oldest is going to be utterly and completely totally free, at college or whatever. In less than a year, total freedom for limited time periods behind the wheel, visiting stores and other peoples houses, etc.

Building a better cage is not going to help the kids relate, when they're finally released/paroled into society.

Which kids have the biggest problems at 14? The kids of "anything goes" parents. Which kids have the biggest problems at 19? The kids of overprotective parents. On average, 14 year olds can get into less trouble than 19 year olds. So, teach them responsibilities of freedom at 14 with your guidance, not 19 and alone.

Parents should be the ones making these decisions instead of the government (Australia anyone?). This goes to the heart of the argument regarding censuring content and who's responsibility it is to decide. Adults should be able to decide for themselves and parents should decide for their kids. It is up to each parent to decide what is and is not appropriate for their kids and to determine the best way to do it. Saying that the poster is enforcing fascist policies on his/her kids is the same argument that a government uses when trying to implement censorship laws on its citizens: you know what is better for them more than they do.

As for the technical question: Most of what you want to implement can be done through an off-the-shelf router that has had the firmware flashed with DD-WRT. You can set up individual profiles for the MAC address of the kids laptops that limits the times that they can access the internet, and when you ground them you can disable access completely via their individual profile. It also has some VERY basic web filtering. You have to have/buy a router that is supported by DD-WRT, but you can get one pretty cheap. The ASUS 520GU is supported and it usually can be had at NewEgg for around $40. If want more robust web filtering you can set up a linux server and run Dan's Guardian & install Nagios for hardware monitoring.

OS X will do pretty much everything you've asked for, with very little work. You can use parental controls to create a whitelist for which programs and websites are allowed. You can restrict account access to specific times and days. You can use ssh or vnc to connect to each machine to remotely administer it. (OS X has a very nice, fast, VNC client and server built in.) You don't need a virus scanner, since there are no viruses in the wild for OS X. You can prevent installation of additional programs. Automatically limit access to adult websites. Restrict who they can mail and IM with. Limit computer use to a certain number of hours per day. Log what they have been doing. Receive e-mail requests to add additional websites, IM users, etc. so that you can confirm additions without having to use their computer. And if you install the istat pro widget, you can monitor all of the computer's hardware sensors, which will give you all of the rest of the info you asked for. VERY easy to set all of this up.

The parent is described as "computer-handicapped", so let's put it in terms he or she will understand: Consider, instead those old-fashed toys of yesteryear. Or consider the TV which many kids of my generation had in their rooms.

Could you imagine a parent asking that his children's toys will automatically stop working on 10pm? Or that his TV cannot be turned on when the child is grounded, or perhaps show only certain channels at certain times? Or the toys checking themselves and letting the parent know when one of them gets broken?

This is all ridiculous, of course. With toys and TV you simply couldn't even imagine doing this. With a computer you can *imagine* doing it, but it doesn't mean it makes sense to do it. A child will always find ways to break such technological rules, especially if the parent is so-called "computer-handicapped".

That project you stated looks fare to complex for a single home user to manage. Yes you could get OS X/Windows 7/Linux to have schedules to shut things down, block sites etc... but really it is easier and cheaper to have a lockable cupboard and lock the computer/s up when you don't want them to be use and just make rules for your kids to follow about usage hours/grounding etc...

Don't rely on technology to parent for you (from a family of 4) you need to do it yourself. If you don't trust your kids with what they look up when you are not there then only bring out the computers when you are there.

One thing to note; children will _ALWAYS_ find a way around any security/punishment you give them (even the physical one I am talking about). The best solution to this is active parenting and trying to be an unobtrusive part of their lives

The complexity and ongoing maintenance (nevermind teaching how to actually use these things) of setting up a full group policy domain.... for 3 PCs.... to be administered by a non tech savvy, time-limited single parent...

Seriously you're so much better off teaching them a few PC basics and installing a few filters etc. on their PCs. And meatspace solutions (e.g. physically locking away PCs or kb/mice). I'm not going to get into the censorship/freedom thing, its not my (or your) kids....

Worked fine for me growing up, parents would say 'no more nintendo' and enforce it with a stick lol.

As a parent and as also an admin who has to worry that co-workers will act like kids, I have both some experience and some tips in this area. The most important tip is to know your kids and care about them. Train them to be safe and teach them morals. With my kids, I use the motto: Trust but verify.

Basic Security: The kids shouldn't have Administrator access, the bios needs a password you don't type in front of them and the boot sequence should be set to boot from hard drive first. They might still get around that security by moving drives around, so you may want tamper evident tape.

Command line tools: go ahead and install an ssh server on the windows clients, but do it the easy way with something like sshwindows*. You don't really need it if you enable RPC, but it does come in handy, particularly in combination with unixutils* and Sysinternals*.

Remote commands: I use winexe* and enable remote access services on the client machines. You can then run the shutdown command or pretty much any other command remotely. If you have set the boot password as required for startup, shutting the PC down is the same as locking it. I don't really recommend requiring a password for boot if you can avoid it since it is a pain, but if the situation calls for it, it is useful to know that you can. In most cases the bios will let you set a password for modification without requiring one for booting and this is usually much easier to work with, particularly when it comes to automatic updates that reboot.

IP tables with static IPs: Since you have admin and they don't, you can set static IPs on the workstations pretty reliably which also allows you to use IP tables effectively to limit or control access.

Logs and web control: If you use OpenDNS* and intercept DNS*, then you have pretty decent logs. If you use a transparent squid proxy in combination with strict IP tables rules, you can get really good logs. Beware of SSL proxies and VPNs.

All this comes with a cost of your time and effort. The tools built into the typical router can do a lot of the work for you, but you give up some control. Also, consider your target audience, if your kids are bright teenagers, then they will look at ways around the system. They will almost certainly try to browse by IP or through proxies. If this is a potential issue, then you should also look at setting up a transparent squid proxy and blocking 443 and other ports for addresses not explicitly allowed.

VNC: I didn't list VNC because I don't personally use it at the moment, but I have in the past and it can be a very useful tool. If you use it, I recommend you don't set it to run automatically, but rather start the service when you want to use it with remote commands. In a few cases I've done this so that I could monitor activity without any obvious indication.

Why bother? Get three corded computers, put them in a common area, if it breaks they have to deal with.
If you're awesome, set up a Windows box, Mac, and Linux machine to expose them to all three big worlds with multiuser accounts on each.

Accept the younger generation is smarter than you and will easily circumvent any idle attempts at restriction.

Unless your genuine intent is to spur the next generation of defcon attendees, just let them learn how to compute while they still live in your house.

I had my first lockpick set when I was 14. Padlocks, particularly the kind typical tightwad single parents used, were no barrier to me. For $10 a week I'd pick the lock to a guy's mom's bedroom, then pick the lock to her weed storage box so he and his friends could get high. It was easy money.

Learn to configure/administer virtualization. You control what gets on the box, and "never" have to worry about permanently hosing the machine, even if they have administrator privileges.

Sounds like he needs a firewall machine to regulate internet access (But I can't think of any prepackaged firewall software that will not require work to configure/administer). He could order up win7 ultimate as a central server, doling out usage rights to the clients, managin

I'm not talking VirtualBox, I'm talking something with a real hypervisor like Xen. You configure Xen for the client to get all the "juice", and maybe localize the game software. Then again, I've never tried running something like FEAR2 on a virtual client...

Yes - and you exert that control by talking to them, occasionally looking over their shoulder and showing them some amount of trust, not by installing a totalitarian regime in your home. Technology does not substitute for parenting.

Never said it did. But occasionally you have to clean the house, cook dinner, go to the bathroom. Not all of us have the leisure to hover over children all day. Especially a single parent, as referred to in the post. This is just a gateway, not a solution. It will never be perfect, and it will require an attentive parent. I would also say keep ALL of the computers in the living room. With less privacy, they are less likely to "cheat" the filters. The old "Daylight is the best disinfectant" sort of thing.

I hate to sound like an ass, but if you're so scared of what your kids are going to do when you leave for 5 minutes, you're not doing your job as a parent. If they're 2, sure, hover over them - my brother got into our fireplace and covered with ash, as well as took every big sharp steak knife out of a childproofed door in about 30 seconds of 'not there'.

But if your kids are old enough to use the internet, and you're seriously worried they'll burn the house down while you're in the can - you and your kids ha

Electronic bullying can result in teen suicide. Young kids seeing terrorists cut the heads people can be disturbing. I can think of lots of things on the internet that can be as dangerous as a table saw.

Keeping an eye on your kids is not the same thing as having a totalitarian regime. I think that logging what your kids do and when is completely acceptable. Whether you reveal this information to them or not is a different story.

When I was a teenager, I got in all kinds of mischief. It turns out that my parents knew about pretty much all of it, but I did not know about this at the time. They didn't interfere unless they thought that I was getting into something over my head... like when I became very depressed, for a long period of time, and I bought myself a bottle of sleeping pills. That was an important intervention.

Children have no right to privacy. Teenagers chafe at the idea, of course, but the fact is that they are children, and good parenting means making decisions that are in their best interests, not their greatest desires. When they're able to weigh their actions with the consequences of those actions (i.e., becoming an adult), then they get privacy.

When your daughter starts googling birth control, it's time to have a chat.

The thing is, the requirements are extra-detailed and a little anal, which make them seem over-the-top, but they basically boil down to:

(1) Restrict internet usage to normal times so the kids don't stay up until three am on a school night. Reasonable.

(2) Revoke access as a punishment. Kids have been getting grounded for how long?

(3) Block access to some sites. Entirely reasonable if you're talking really bad sites or malware infected stuff. It doesn't necessarily equate to some active proxy reading their facebook posts. Besides, I'm sure the kids don't want to see goatse any more than you.

I'm sure plenty of good parents keep guns in a safe and liquor in a locked liquor cabinet. Obviously a gun or booze is more dangerous than the internet, I'm not trying to equate them, but there are advantages to a layered system of trust. Technology and good parenting aren't mutually exclusive.

It's a little over the top but parents are supposed to keep an eye on what their own kids do.At least that's the reply whenever parents try to foist that particular burden on society rather than do it themselves.

Hehe, well, true - that might actually the best use for a setup like the one asked for. They might be more motivated in learning proper hacking techniques if they can use it to circumvent your controls.

I am not implying that the kids should vote on the mode of their internet use. But if you do not give them any freedom, including the freedom to violate the agreed upon rules, you do not give them any trust. How should they ever learn responsible behaviour without experiencing trust and freedom?

[...] if you had a Windows Domain Controller. That's probably outside of your budget. [...]

Some linux-friendly routers will allow you to run a Samba DC on them. Samba 4 supports Group Policies. It is marked as not being production-ready, but it should be safe enough for a home network. While you're at it, the same Samba could provide printer sharing for all the machines.

(Not that I believe that Group Policies can replace proper parenting, though. Using technology to solve social problems seldom is a smart idea.)

I think he's lacking in some other department too. From the POV he's talking about, he's just going to make bypassing the technical restrictions a game to his kids.It's like a boss spending megabucks on technical solution, when he should instead make control of employees mainly a management thing that's aided by cheaper and less elaborate technical solutions.

If Boss just puts up expensive technical controls, and is not known for enforcing policy, he's not going to get compliance.